[5871] in RedHat Linux List
Re: RedHat4.0 security
daemon@ATHENA.MIT.EDU (Elliot Lee)
Sun Nov 24 17:56:44 1996
Date: Sun, 24 Nov 1996 17:44:08 -0500 (EST)
From: Elliot Lee <sopwith@cuc.edu>
To: Ian Burrell <iburrell@leland.Stanford.EDU>
cc: redhat-list@redhat.com
In-Reply-To: <19961123001506.1800.qmail@quark.Stanford.EDU>
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
On Fri, 22 Nov 1996, Ian Burrell wrote:
> >
> > On Fri, 22 Nov 1996, Cristian Gafton wrote:
> >
> > > On Thu, 21 Nov 1996, Erik Troan wrote:
> > >
> > > > -r-sr-xr-x- root root 5332 Sep 09 19:39 /usr/sbin/inndstart
> > >
> > > binds innd to port 119 and then change the uid to news...
> >
> > Elliot suggested changing this to
> >
> > -r-sr-x---- root news 5332 Sep 09 19:39 /usr/sbin/inndstart
> >
> > comments?
> >
>
> That is rather futile. When it is running as root, it can do anything
> so the group doesn't matter. If it really needs to be group news, it
> can set it itself. SUID only applies to the UID, the GID doesn't
> change, so the innd doesn't become root group in the first case.
My idea was to make it so that inndstart was runable only by those in the
'news' group - restricting access from the world...
-- Elliot
http://www.redhat.com/
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
